diff --git a/backend/app/core/permissions.py b/backend/app/core/permissions.py
new file mode 100644
index 0000000..51b0693
--- /dev/null
+++ b/backend/app/core/permissions.py
@@ -0,0 +1,58 @@
+"""Role-Based Access Control (RBAC) definitions and checks.
+
+Roles hierarchy (highest authority = human):
+  super_admin   - Platform-level, manages all tenants (always human)
+  tenant_admin  - Tenant-level admin, manages users/workers (human)
+  project_manager - Creates/manages projects, assigns tasks (human)
+  reviewer      - Reviews AI output, approves/rejects (human)
+  worker        - Executes tasks (can be human or AI)
+"""
+
+from enum import Enum
+from typing import Set
+
+
+class Role(str, Enum):
+    SUPER_ADMIN = "super_admin"
+    TENANT_ADMIN = "tenant_admin"
+    PROJECT_MANAGER = "project_manager"
+    REVIEWER = "reviewer"
+    WORKER = "worker"
+
+
+# Role hierarchy for comparison (higher number = more authority)
+ROLE_LEVELS = {
+    Role.WORKER: 1,
+    Role.REVIEWER: 2,
+    Role.PROJECT_MANAGER: 3,
+    Role.TENANT_ADMIN: 4,
+    Role.SUPER_ADMIN: 5,
+}
+
+
+def has_role(user_role: str, required_roles: Set[Role]) -> bool:
+    """Check if user_role is in the set of required roles."""
+    try:
+        role = Role(user_role)
+    except ValueError:
+        return False
+    return role in required_roles
+
+
+def has_min_role(user_role: str, min_role: Role) -> bool:
+    """Check if user_role meets the minimum role level."""
+    try:
+        role = Role(user_role)
+    except ValueError:
+        return False
+    return ROLE_LEVELS.get(role, 0) >= ROLE_LEVELS.get(min_role, 0)
+
+
+# Permission sets for common operations
+CAN_CREATE_TENANT = {Role.SUPER_ADMIN}
+CAN_MANAGE_USERS = {Role.SUPER_ADMIN, Role.TENANT_ADMIN}
+CAN_MANAGE_WORKERS = {Role.SUPER_ADMIN, Role.TENANT_ADMIN}
+CAN_CREATE_PROJECT = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER}
+CAN_ASSIGN_TASK = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER}
+CAN_REVIEW = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER, Role.REVIEWER}
+CAN_EXECUTE_TASK = {Role.SUPER_ADMIN, Role.TENANT_ADMIN, Role.PROJECT_MANAGER, Role.WORKER}